Reflected Cross-Site Scripting

Overview There is an XSS vulnerability in affected versions of auth0-lock. Overview Versions before and including 11.30.0 are vulnerable to reflected XSS. An attacker can execute arbitrary code when the library's - flashMessage feature is utilized and user input or data from URL parameters is...

@brudi-toolbox/id (>=1.4.5-next.1, <=2.0.4), @cimpress/simple-auth-wrapper (>=3.0.0, <=3.1.6) +4 more potentially affected by CVE-2021-32641 via auth0-lock (>=11.0.1, <=11.28.1)

auth0-lock NPM version =11.0.1, =1.4.5-next.1, =3.0.0, =0.0.1, =1.0.42, =0.11.0, =0.25.0 Source cves: CVE-2021-32641 Source advisory: OSV:GHSA-JR3J-WHM4-9WWM...

Reflected XSS when using flashMessages or languageDictionary

Overview Versions before and including 11.30.0 are vulnerable to reflected XSS. An attacker can execute arbitrary code when the library's - flashMessage feature is utilized and user input or data from URL parameters is incorporated into the flashMessage. - languageDictionary feature is utilized a...

CVE-2021-32641: Improper Neutralization of Input During Web Page Generation

auth0-lock is Auth0's signin solution. Versions of nauth0-lock before and including 11.30.0 are vulnerable to reflected XSS. An attacker can execute arbitrary code when the library's flashMessage feature is utilized and user input or data from URL parameters is incorporated into the flashMessage ...

Cross-Site Scripting (XSS)

auth0-lock is vulnerable to cross-site scripting XSS. When using Passwordless or Enterprise connection mode, an attacker is able to inject and execute arbitrary Javascript in a victim's browser via the email or phone number in Passwordless connection, and the IdP domain in Enterprise connection...

CVE-2020-15119

In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used, the application and its users might be exposed to cross-site scripting XSS attacks...

Cross site scripting

In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used, the application and its users might be exposed to cross-site scripting XSS attacks...

CVE-2020-15119

CVE-2020-15119 concerns the auth0-lock widget. Vulnerability: using dangerouslySetInnerHTML to update the DOM can enable cross-site scripting (XSS) when Passwordless or Enterprise connections are used. Affected versions: before and including 11.25.1. Impact: potential exposure of arbitrary JavaSc...

CVE-2020-15119 DOM-based XSS in auth0-lock

In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used, the application and its users might be exposed to cross-site scripting XSS attacks...

DOM-based XSS

Overview Versions before and including 11.25.1 are using dangerouslySetInnerHTML to display an informational message when used with a Passwordless or Enterprise connection. For Passwordless connection, the value of the input email or phone number is displayed back to the user while waiting for...

@brudi-toolbox/id (>=1.4.5-next.1, <=1.14.15), @cimpress/simple-auth-wrapper (>=3.0.0, <=3.1.6) +4 more potentially affected by CVE-2020-15119 via auth0-lock (>=11.0.1, <=11.26.1)

auth0-lock NPM version =11.0.1, =1.4.5-next.1, =3.0.0, =0.0.1, =1.0.42, =0.11.0, =0.21.2 Source cves: CVE-2020-15119 Source advisory: OSV:GHSA-6GG3-PMM7-97XC...

GHSA-6GG3-PMM7-97XC DOM-based XSS in auth0-lock

Overview Versions before and including 11.25.1 are using dangerouslySetInnerHTML to display an informational message when used with a Passwordless or Enterprise connection. - For Passwordless connection, the value of the input email or phone number is displayed back to the user while waiting for...

DOM-based XSS in auth0-lock

Overview Versions before and including 11.25.1 are using dangerouslySetInnerHTML to display an informational message when used with a Passwordless or Enterprise connection. - For Passwordless connection, the value of the input email or phone number is displayed back to the user while waiting for...

CVE-2020-15119: Improper Neutralization of Input During Web Page Generation

In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used, the application and its users might be exposed to cross-site scripting XSS attacks...

CVE-2019-20174

Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder...

CVE-2019-20174

Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder...

Cross site scripting

Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder...

CVE-2019-20174

Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder...

CVE-2019-20174

Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder...

Cross-Site Scripting (XSS)

Auth0-Lock is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary and execute arbitrary Javascript into a user's browser via the placeholder property. Customers using the additionalSignUpFields customization option are affected...